& changes to & how can I revert it back to & on view

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Roger F
    New Member
    • Aug 2010
    • 2

    #1

    & changes to & how can I revert it back to & on view

    Help Please

    When I insert code into my database ie.
    Code:
    This & That
    I see it is the same in the data base but when I go to view it, it as changed into.
    Code:
    This & That
    What is happening, rather a noob here sorry..

    Here are my page's.

    database name
    Code:
    collections
    connect.php
    Code:
    <?php
    
    $con = mysql_connect("localhost","root","root");if (!$con)
      {
      die('Could not connect: ' . mysql_error());
      }
    
    mysql_select_db("collections", $con);
    
    ?>
    add.php

    Code:
    <html>
    
    <title></title>
    <body >
            <center>
    </center>
    
    
    <table align="center" border="0" width="220" height="400">
        <tr>
            <td width="210" height="381">
    <form  align="center" action="insert.php" method="post" NAME="Entry_Form">
    <center> Collection: <SELECT NAME="type">
    <OPTION VALUE="">Choose a Collection</option>
    <OPTION VALUE="Gardening">Gardening</option>
    <OPTION VALUE="Country">Country</option>
    <OPTION VALUE="Button">Button</option>
    <OPTION VALUE="Bugs">Bugs</option>
    <OPTION VALUE="Butterfly">Butterfly</option>
    <OPTION VALUE="Feather" >Feather</option>
    </SELECT>
    <br /><br /><br /><br />Paste Link<br /><input type="text" name="link" / size="30"><br /><br /> <br />
    <input type="submit" value="Submit" name="Submit">
    
    </center>
    
    
    </form>
    </td>
        </tr>
    </table>
    
    </body>
    </html>
    index.php

    Code:
    <html>
        <head>
            <title>Search Test</title>
        </head>
        <body>
    <center>
    
    
    
    <?php
    include("connect.php");
    ?>
    
    <form action="Search.php" method="post">
    <select name="searchterm">
    <option selected value="artist">Select Catogory </option>
    <?php
    $sql="SELECT DISTINCT `type` FROM farm ORDER BY `type`";
    $result =mysql_query($sql);
    while ($row=mysql_fetch_assoc($result)){
    ?>
    
    <option value ="<?php echo $row['type'] ?>" ><?php echo $row['type'] ?></option>
    <?php } ?>
    
    </select>
    
                <input type="submit" value="Go">
    </form>
    </center>
    </body>
    </html>

    insert.php
    Code:
    <?php
    include("connect.php");
    $sql="INSERT INTO farm (type, link) VALUES ('$_POST[type]', '$_POST[link]')";
    if (!mysql_query($sql,$con)) {
     die('Error: ' . mysql_error());
    }
    echo "<body bgcolor=\"white\" text=\"black\">";
    //echo "Added to your database....";
    
    mysql_close($con);
    echo "<br /><br /><br /><br /><br />";
    echo "<p align=\"center\"><b>Data Added</b></p>";
    echo "<br /><br /><br /><br />";
    echo "<p align=\"center\"><b><a href=\"add.php\">Add More Entries</a></b></p>";
    
    ?>
    Search.php
    Code:
    <?php
    include("index.php");
    /*set varibles from form */
    $searchterm = $_POST['searchterm'];
    
    /* connects to database */
    @ $con = new mysqli("localhost","root","root","collections");
    if (mysqli_connect_errno())
    {
    echo 'Error: Could not connect to database.  Please try again later.';
    exit;
    }
    /*query the database*/
    $query = "select * from `farm` where `type` like '%".$searchterm."%'";
    $result = $con->query($query);
    
    /*number of rows found*/
    $num_results = $result->num_rows;
    
    //echo '<center><p>Found: '.$num_results.'</p></center>';
    /*loops through results*/
    for ($i=0; $i <$num_results; $i++)
    {
    $num_found = $i + 1;
    $row = $result->fetch_assoc();
    
    //Table Here
    
    echo "<table border=\"0\" width=\"134\" align=\"center\" height=\"22\">\n";
    echo "    <tr>\n";
    echo "        <td width=\"100\" align=\"center\" valign=\"top\">\n";
    echo "<form align=\"center\">\n";
    echo "<a href='#' onClick=\"hid.value=document.getElementById(". $row['id'] . ").innerHTML;hid.createTextRange().execCommand('Copy')\"  title=\"Click To Copy Link Then Paste Into Browser\" ><img src=\"http://feckie.eu/copy_link.png\" width=\"102\" height=\"22\"/></a>\n";
    echo "<input type=hidden name=hid>\n";
    echo " </form>\n";
    echo "<div id='". $row['id'] . "'style='display:none;'>\n";
    echo "". $row['link'] . "\n";
    echo "</div>\n";
    echo "</td>\n";
    echo " <td width=\"10\" valign=\"top\">&nbsp;</td>\n";
    echo "        <td width=\"24\" valign=\"top\">". $row['type'] . "</td>\n";
    echo "    </tr>\n";
    echo "</table>";
    
    }
    /*free database*/
    
    $result->free();
    $con->close();
    ?>
    Last edited by Roger F; Aug 25 '10, 04:36 PM. Reason: Resolved
  • TheServant
    Recognized Expert Top Contributor
    • Feb 2008
    • 1168

    #2
    This is either your PHP or your MySQL. Echo/print one of your $_POST variables with a special character in it to see if it has converted it by there. If so, it's your PHP, and if not it's your MySQL.

    Generally auto conversion is bad, and you should be writing your own sanitation script to do to everything before it goes into your database. From this you will also need to have a conversion when you get it out of your databse. This way you personally know exactly when is going in (and that it's safe) and hence you know how to get it out.

    Some reading material for conversion:
    htmlentities
    html_entity_dec ode
    htmlspecialchar s
    htmlspecialchar s_decode
    mysql_real_esca pe_string

    Comment

    • Roger F
      New Member
      • Aug 2010
      • 2

      #3
      Fixed

      The problem laid in the line

      Code:
      .innerHTML;hid.createTextRange()
      On the search.php, it should have been

      Code:
      .innerText;hid.createTextRange()

      Many thanks

      Comment

      • TheServant
        Recognized Expert Top Contributor
        • Feb 2008
        • 1168

        #4
        Ahh yes. Javascript. Didn't see that. Glad you got it sorted.

        Comment

        Working...